The present invention relates generally to computer security, and more particularly, to identification of keystroke events not originated by a local physical keyboard device.